Fix CVE-2008-1142

(Portage version: 2.1.4.4)

3 files changed, 102 insertions, 1 deletions

diff --git a/x11-terms/rxvt-unicode/ChangeLog b/x11-terms/rxvt-unicode/ChangeLog
index d618f22dcf51..8edbf4be760b 100644
--- a/x11-terms/rxvt-unicode/ChangeLog
+++ b/x11-terms/rxvt-unicode/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for x11-terms/rxvt-unicode
 # Copyright 2000-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/x11-terms/rxvt-unicode/ChangeLog,v 1.104 2008/03/20 20:45:02 killerfox Exp $
+# $Header: /var/cvsroot/gentoo-x86/x11-terms/rxvt-unicode/ChangeLog,v 1.105 2008/05/04 18:44:30 killerfox Exp $
+
+*rxvt-unicode-9.02-r1 (04 May 2008)
+
+  04 May 2008; René Nussbaumer <killerfox@gentoo.org>
+  +files/rxvt-unicode-9.02-CVE-2008-1142-DISPLAY.patch,
+  +rxvt-unicode-9.02-r1.ebuild:
+  Fix CVE-2008-1142
 
 *rxvt-unicode-9.02 (20 Mar 2008)
 
diff --git a/x11-terms/rxvt-unicode/files/rxvt-unicode-9.02-CVE-2008-1142-DISPLAY.patch b/x11-terms/rxvt-unicode/files/rxvt-unicode-9.02-CVE-2008-1142-DISPLAY.patch
new file mode 100644
index 000000000000..6bcfb5cf6111
--- /dev/null
+++ b/x11-terms/rxvt-unicode/files/rxvt-unicode-9.02-CVE-2008-1142-DISPLAY.patch
@@ -0,0 +1,24 @@
+diff -urN rxvt-unicode-9.02.orig/src/init.C rxvt-unicode-9.02/src/init.C
+--- rxvt-unicode-9.02.orig/src/init.C	2008-05-04 20:16:26.000000000 +0200
++++ rxvt-unicode-9.02/src/init.C	2008-05-04 20:24:14.000000000 +0200
+@@ -372,15 +372,16 @@
+    * Open display, get options/resources and create the window
+    */
+ 
+-  if ((rs[Rs_display_name] = getenv ("DISPLAY")) == NULL)
+-    rs[Rs_display_name] = ":0";
++  rs[Rs_display_name] = getenv ("DISPLAY");
+ 
+   get_options (r_argc, r_argv);
+ 
+-  if (!(display = displays.get (rs[Rs_display_name])))
++  if (!rs[Rs_display_name] || !(display = displays.get (rs[Rs_display_name])))
+     {
+       free (r_argv);
+-      rxvt_fatal ("can't open display %s, aborting.\n", rs[Rs_display_name]);
++      rxvt_fatal ("can't open display %s, aborting.\n", 
++                  (rs[Rs_display_name] ? rs[Rs_display_name] : 
++                   "as no -display option given and DISPLAY not set"));
+     }
+ 
+   // using a local pointer decreases code size a lot
diff --git a/x11-terms/rxvt-unicode/rxvt-unicode-9.02-r1.ebuild b/x11-terms/rxvt-unicode/rxvt-unicode-9.02-r1.ebuild
new file mode 100644
index 000000000000..eace3bd8b45c
--- /dev/null
+++ b/x11-terms/rxvt-unicode/rxvt-unicode-9.02-r1.ebuild
@@ -0,0 +1,70 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/x11-terms/rxvt-unicode/rxvt-unicode-9.02-r1.ebuild,v 1.1 2008/05/04 18:44:30 killerfox Exp $
+
+inherit flag-o-matic
+
+DESCRIPTION="rxvt clone with XFT and Unicode support"
+HOMEPAGE="http://software.schmorp.de/"
+SRC_URI="http://dist.schmorp.de/rxvt-unicode/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~hppa ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd"
+IUSE="truetype perl iso14755"
+
+# see bug #115992 for modular x deps
+RDEPEND="x11-libs/libX11
+	x11-libs/libXft
+	media-libs/libafterimage
+	x11-libs/libXrender
+	perl? ( dev-lang/perl )"
+DEPEND="${RDEPEND}
+	dev-util/pkgconfig
+	x11-proto/xproto"
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	local tdir=/usr/share/terminfo
+
+	# Fix CVE-2008-1142
+	epatch "${FILESDIR}/${P}-CVE-2008-1142-DISPLAY.patch"
+
+	sed -i -e \
+		"s~@TIC@ \(\$(srcdir)/etc/rxvt\)~@TIC@ -o ${D}/${tdir} \1~" \
+		doc/Makefile.in
+}
+
+src_compile() {
+	myconf=''
+
+	use iso14755 || myconf='--disable-iso14755'
+
+	econf \
+		--enable-everything \
+		$(use_enable truetype xft) \
+		$(use_enable perl) \
+		--disable-text-blink \
+		${myconf} \
+		|| die
+
+	emake || die
+
+	sed -i \
+		-e 's/RXVT_BASENAME = "rxvt"/RXVT_BASENAME = "urxvt"/' \
+		"${S}"/doc/rxvt-tabbed || die "tabs sed failed"
+}
+
+src_install() {
+	make DESTDIR="${D}" install || die
+
+	dodoc README.FAQ Changes
+	cd "${S}"/doc
+	dodoc README* changes.txt etc/* rxvt-tabbed
+}
+
+pkg_postinst() {
+	einfo "urxvt now always uses TERM=rxvt-unicode so that the"
+	einfo "upstream-supplied terminfo files can be used."
+}